CVE-2026-81339

The MasterStudy LMS WordPress Plugin (versions before 3.7.50 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The plugin fails to perform a per-object ownership check when returning quiz attempt results. This allows any authenticated user with at least a minimal subscriber role to ...

CVE-2022-4997

The jet-form-builder-stripe-gateway WordPress plugin versions prior to 1.1.0 is vulnerable to an unauthenticated Blind SQL Injection . The root cause is the failure to sanitize and escape a payment token before utilizing it in a SQL statement. This flaw allows unauthenticated attackers to extract...

CVE-2025-15696

The Real3D Flipbook WordPress plugin (versions before 5.4 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw due to a failure to sanitize or escape several flipbook editor fields before rendering them in the admin editor. This allows users with the Author role or higher to inject arbitra...

CVE-2026-18365

The zportals WordPress plugin in versions prior to 6.4.2 is vulnerable to an unauthorized information disclosure flaw. The root cause is the failure to perform capability or nonce checks on one of its AJAX actions . This allows authenticated users with subscriber-level accounts to disclose the di...

CVE-2026-18364

The zportals WordPress plugin versions prior to 6.4.2 is vulnerable to an unauthorized settings modification. The root cause is the failure to perform capability or nonce checks on several AJAX actions . This allows users with low-privileged subscriber-level accounts to modify the plugin's stored...

CVE-2026-14321

The divi-dash WordPress plugin, versions prior to 1.0.7 , is vulnerable to an unauthenticated Denial of Service due to insufficient validation of client IP addresses used for rate limiting and banning. An attacker can spoof arbitrary IP addresses to bypass these security measures, ban legitimate ...

CVE-2026-16264

The Newsletters WordPress plugin versions before 4.18.1 is vulnerable to an IDOR (Insecure Direct Object Reference) flaw. The plugin fails to perform adequate ownership checks on certain subscriber management actions and can issue management sessions to unauthenticated visitors . This allows an a...

CVE-2026-86785

The Social Commerce for WooCommerce WordPress plugin, version 2.5.4 and below , is vulnerable to an unauthenticated privilege escalation. The root cause is a lack of authorization checks on specific REST API endpoints , which allows attackers to modify the plugin's configuration and product synch...

CVE-2026-19438

ABB Mint Workbench I is vulnerable to a Path Traversal vulnerability (Improper Limitation of a Pathname to a Restricted Directory). This issue affects versions through 5876 . The vulnerability allows for unauthorized access to files or directories outside of the intended restricted scope. No spec...

CVE-2026-96258

A cross-site scripting (XSS) vulnerability exists in the Public Password Reset Endpoint of onSite internet GmbH Auktion NG Auktionssoftware (versions up to 20260722). The flaw is located within the /forgotpasswd.html file, where manipulating the email argument allows for remote execution of the a...

CVE-2026-96257

A stack-based buffer overflow vulnerability exists in the Device Discovery Service component of Fast FAC1203R Gigabit Edition 2.0.4 . The flaw is located within the copy_msg_element function and can be triggered remotely. An exploit has been published and may be used in the wild. No remediation d...

CVE-2026-95958

A security flaw exists in JusticeRage Manalyze 1.0.0 within the PE Parser component. Specifically, the PE::_parse_relocations function in the file manape/pe.cpp is vulnerable to an integer underflow triggered by manipulating the BlockSize argument. This vulnerability requires a local approach for...

CVE-2026-95957

A cross-site scripting (XSS) vulnerability exists in the SourceCodester Smart Attendance System with QR Code Scanner 1.0 within the Self-Registration component. The flaw is located in the prepend function of the student_signup.php file. By manipulating the full_name argument, an attacker can achi...

CVE-2026-91777

The FasterXML jackson-databind library is vulnerable to a quadratic CPU work issue during deserialization. The root cause lies in the CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() (and the equivalent in MapDeserializer ) methods, where forward-reference completio...

CVE-2026-91776

The FasterXML jackson-databind library is vulnerable to an unbounded memory growth issue within the TypeDeserializerBase._findDeserializer() method. When name-based polymorphism is configured with a defaultImpl or equivalent fallback, the component caches every unique, unrecognized type ID provid...

CVE-2026-95930

The iFlytek astron-agent (up to version 1.0.6 ) is vulnerable to a server-side request forgery (SSRF) . The flaw exists in the UrlCheckTool.checkUrl function within the debugToolV2 API endpoint, where a remote attacker can manipulate the endPoint argument to initiate unauthorized requests. To rem...

CVE-2026-89425

The FasterXML jackson-core library contains a vulnerability in the UTF8DataInputJsonParser._reportInvalidToken() method. The root cause is that this specific parser fails to honor ErrorReportConfiguration.getMaxErrorTokenLength() (default 256) when building error messages, unlike other sibling im...

CVE-2026-95929

A SQL injection vulnerability exists in iFlytek astron-agent (versions up to 1.0.7 ). The flaw is located within an unknown function involving the file console/backend/commons/src/main/resources/mapper/ChatBotMarketMapper.xml specifically within the getBotList API endpoint. An attacker can perfor...

CVE-2026-95928

A security flaw in recommenders-team recommenders up to version 1.2.1 allows for deserialization via the pickle.load function in the file recommenders/models/newsrec/io/mind_iterator.py (Dict Loading component). An attacker can initiate this attack remotely by performing a manipulation. Public ex...

CVE-2026-95927

The SourceCodester Online Reviewer Management System 1.0 is vulnerable to a SQL injection vulnerability in the file /reviewer_0/admins/assessments/pretest/exam-delete.php. The root cause is the improper handling of the test_id argument, which allows for remote manipulation. This vulnerability cou...

CVE-2026-95926

The SourceCodester Online Reviewer Management System 1.0 is vulnerable to a remote SQL injection vulnerability. The flaw exists within an unknown function in the file /reviewer_0/admins/assessments/pretest/btn_functions.php?action=update. Attackers can exploit this by manipulating the test_id arg...

CVE-2026-95925

A SQL injection vulnerability exists in SourceCodester Online Reviewer Management System 1.0 . The flaw is located within an unknown function in the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=update, where manipulating the difficulty_id argument allows for remote execut...

CVE-2026-95924

A SQL injection vulnerability exists in the SourceCodester Online Reviewer Management System 1.0 . The flaw is located in an unknown function within the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=add. An attacker can exploit this by manipulating the difficulty_id argume...

CVE-2026-95897

A security vulnerability exists in Dask up to version 2026.8.0 within the Loader component. The flaw is located in the from_npy_stack function of the dask/array/core.py file, where improper handling leads to deserialization issues. This vulnerability can be exploited via a remote attack . While t...

CVE-2026-96273

Ghidra versions prior to 12.1.4 are vulnerable to a Denial of Service condition due to a lack of validation of the TYPE_COL byte within the OptionsDB.createUnregisteredOption() function. This flaw triggers an ArrayIndexOutOfBoundsException, resulting in domain objects becoming permanently locked....

CVE-2026-96272

ClipBucket v5 versions prior to 5.5.3-#182 are vulnerable to a blind SQL injection vulnerability within the photo search endpoint. The root cause is the unsanitized passage of the query parameter into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can leverage time-based blind SQL inje...

CVE-2026-96271

Photoview through version 2.4.0 is affected by an authorization bypass vulnerability within the shareAlbum GraphQL mutation . This flaw allows authenticated users to generate functional share tokens for albums owned by other users by supplying arbitrary album IDs. Consequently, attackers can expo...

CVE-2026-95868

A SQL injection vulnerability exists in the Search Form component of the AdithyaYelloju Restaurant-Management-System (up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c). The flaw is caused by the improper handling of the s1 argument within the mysqli_query function in the admin/display_menu.p...

CVE-2026-96384

The Mermaid Diagram Field module for Drupal contains an access bypass vulnerability. The module fails to sufficiently respect default revision behavior and lacks proper access controls for modal content . This issue is mitigated by the requirement that an attacker must either have the modal displ...

CVE-2026-96390

The Editoria11y Accessibility Checker module for Drupal contains an access bypass vulnerability. The module incorrectly labels a permission as a "view" permission when it actually grants edit and delete access to module data. This occurs within the functionality that runs a client-side accessibil...

CVE-2026-96370

The Webform module for Drupal contains a server-side request forgery (SSRF) vulnerability within its Webform Submission Export/Import submodule. The root cause is insufficient access validation , allowing users with permissions to edit webform submissions and access results to reach the import in...

CVE-2026-96386

The Smart Content Block submodule of the Smart Content module for Drupal contains an access bypass vulnerability. The root cause is an insufficient check of block access when the module renders blocks of a "Display Blocks" reaction via its AJAX endpoint . Impact is mitigated if sites only use Vie...

CVE-2026-96380

The CSS Usage Analyzer module for Drupal is vulnerable to an improper access control flaw. The module fails to sufficiently protect the /css-usage-analyzer/save endpoint against forged or repeated submissions . This allows unauthorized users to post CSS-usage measurements, which are intended to b...

CVE-2026-96367

The Webform module in Drupal contains a vulnerability where the custom attributes YAML editor does not sufficiently restrict access. Users with permissions to create or edit webforms, but who lack permission to edit webform source, can add custom attributes, which may lead to cross-site scripting...

CVE-2026-96358

The Webform module for Drupal contains a vulnerability in its rating element due to insufficient data validation. This flaw could allow cross-site scripting (XSS) on pages featuring a rating element. The risk is mitigated by the requirement that an attacker must first be able to place crafted HTM...

CVE-2026-96388

The Tawk.to - Live chat application module for Drupal sites contains a Cross-Site Request Forgery (CSRF) vulnerability due to insufficient validation of certain requests. This flaw could allow an attacker to trick an authenticated user into performing unintended actions. No specific versions or r...

CVE-2026-96365

The Webform module for Drupal is vulnerable to a Denial of Service (DoS) because it fails to sufficiently validate an optional token query value . Under specific configurations where a Webform is rendered for anonymous visitors , a malicious request can cause the system to consume significant res...

CVE-2026-96356

The Webform module for Drupal contains an access bypass vulnerability. The component fails to sufficiently guard user-specific access rules against malformed saved configurations . Under specific site conditions, an access rule intended to restrict submission access to selected user accounts coul...

CVE-2026-96371

The Webform module for Drupal allows users with webform creation or editing permissions to enter source configurations that are rendered unsafely when the Webform UI module is disabled. This vulnerability arises from insufficient restrictions on raw webform source editing, potentially leading to ...

CVE-2026-96387

The DRUPAL-CONTRIB-2026-183 module fails to sufficiently enforce access restrictions for the administrative user account (user 1) or users with the administrator role across all supported authentication mechanisms. Consequently, a blocked administrative user might still authenticate via certain a...

CVE-2026-96379

The CookieCuttr module for Drupal contains a cross-site scripting (XSS) vulnerability due to insufficient input filtering on the administration form. This flaw allows for the storage and subsequent rendering of specially crafted values without adequate sanitization. Exploitation requires a role w...

CVE-2026-96355

The Drupal Webform module contains a vulnerability where it fails to sufficiently exclude certain format templates from token replacement . This allows an attacker to submit data that is evaluated as template code during rendering. Depending on site configuration and active modules, the impact ca...

CVE-2026-96374

The Project Browser module for Drupal is vulnerable to cross-site request forgery (CSRF) attacks because it fails to sufficiently validate administrative actions performed through the web user interface. An attacker could potentially exploit this to apply recipes or enable modules without proper ...

CVE-2026-96398

The Drupal Webform module contains an access bypass vulnerability because it does not sufficiently restrict access to certain submission view modes. Under specific conditions, a user authorized to view a submission can access a more permissive view mode, potentially exposing restricted fields. Th...

CVE-2026-96364

The Webform module's Webform Share submodule allows for embedding webforms on external sites. Under certain conditions, submissions for an Ajax-enabled Webform using this submodule can bypass anti-spam protections . This vulnerability is mitigated if Webform Share is disabled, sharing is turned o...

CVE-2026-96377

The Combined image style Drupal module is vulnerable to an improper access control issue because it does not sufficiently validate image style names when generating derivatives. This allows anonymous users to generate image derivatives without a valid token, which could potentially lead to a deni...

CVE-2026-96392

The AI CKEditor module for Drupal contains a vulnerability where it fails to sufficiently mitigate Twig template injections within specific AI CKEditor rules. This flaw allows an attacker to use Twig functions to extract confidential system data . While the documentation describes the impact as p...

CVE-2026-79304

CyberPanel version 1.9.1 is vulnerable to a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker who owns any configured domain can exploit this by supplying an arbitrary absolute or out-of-scope path in the fileName...

CVE-2026-96362

The Webform module for Drupal contains a cross-site scripting (XSS) vulnerability. The root cause is the insufficient filtering of response values from the Remote Post handler before they are rendered via handler response tokens . If a site uses these tokens in rendered output and an attacker can...

CVE-2026-96359

The Drupal Webform module is vulnerable to cross-site scripting (XSS) because it fails to sufficiently sanitize attributes used by its color element . Under specific conditions, specially crafted attributes can execute XSS when the element is rendered. This vulnerability is mitigated by the requi...